From 5bd304bd0e78a0ea8cd37cedb0b1ed39683f4509 Mon Sep 17 00:00:00 2001
From: Huw Davies <huw@codeweavers.com>
Date: Tue, 11 Oct 2011 15:46:19 +0100
Subject: [PATCH] gdi32: The text extents functions fail if passed a negative
 count.

---
 dlls/gdi32/font.c       | 37 ++++++++++++++++++++++++++-----------
 dlls/gdi32/tests/font.c |  9 +++++++++
 2 files changed, 35 insertions(+), 11 deletions(-)

diff --git a/dlls/gdi32/font.c b/dlls/gdi32/font.c
index 6f5e47977c..263d064962 100644
--- a/dlls/gdi32/font.c
+++ b/dlls/gdi32/font.c
@@ -920,9 +920,14 @@ BOOL WINAPI GetTextExtentPoint32A( HDC hdc, LPCSTR str, INT count,
 {
     BOOL ret = FALSE;
     INT wlen;
-    LPWSTR p = FONT_mbtowc(hdc, str, count, &wlen, NULL);
+    LPWSTR p;
 
-    if (p) {
+    if (count < 0) return FALSE;
+
+    p = FONT_mbtowc(hdc, str, count, &wlen, NULL);
+
+    if (p)
+    {
 	ret = GetTextExtentPoint32W( hdc, p, wlen, size );
 	HeapFree( GetProcessHeap(), 0, p );
     }
@@ -975,10 +980,15 @@ BOOL WINAPI GetTextExtentExPointI( HDC hdc, const WORD *indices, INT count, INT
                                    LPINT nfit, LPINT dxs, LPSIZE size )
 {
     BOOL ret = FALSE;
-    DC * dc = get_dc_ptr( hdc );
+    DC *dc;
+
+    if (count < 0) return FALSE;
+
+    dc = get_dc_ptr( hdc );
     if (!dc) return FALSE;
 
-    if(dc->gdiFont) {
+    if(dc->gdiFont)
+    {
         ret = WineEngGetTextExtentExPointI(dc->gdiFont, indices, count, max_ext, nfit, dxs, size);
         size->cx = abs(INTERNAL_XDSTOWS(dc, size->cx));
         size->cy = abs(INTERNAL_YDSTOWS(dc, size->cy));
@@ -1051,11 +1061,15 @@ BOOL WINAPI GetTextExtentExPointA( HDC hdc, LPCSTR str, INT count,
     INT wlen;
     INT *walpDx = NULL;
     LPWSTR p = NULL;
-    
-    if (alpDx &&
-       NULL == (walpDx = HeapAlloc(GetProcessHeap(), 0, count * sizeof(INT))))
-       return FALSE;
-    
+
+    if (count < 0) return FALSE;
+
+    if (alpDx)
+    {
+        walpDx = HeapAlloc( GetProcessHeap(), 0, count * sizeof(INT) );
+        if (!walpDx) return FALSE;
+    }
+
     p = FONT_mbtowc(hdc, str, count, &wlen, NULL);
     ret = GetTextExtentExPointW( hdc, p, wlen, maxExt, lpnFit, walpDx, size);
     if (walpDx)
@@ -1118,9 +1132,10 @@ BOOL WINAPI GetTextExtentExPointW( HDC hdc, LPCWSTR str, INT count,
 
     TRACE("(%p, %s, %d)\n",hdc,debugstr_wn(str,count),maxExt);
 
+    if (count < 0) return FALSE;
+
     dc = get_dc_ptr(hdc);
-    if (! dc)
-        return FALSE;
+    if (!dc) return FALSE;
 
     GetTextMetricsW(hdc, &tm);
 
diff --git a/dlls/gdi32/tests/font.c b/dlls/gdi32/tests/font.c
index 097a6c373a..f1277432c3 100644
--- a/dlls/gdi32/tests/font.c
+++ b/dlls/gdi32/tests/font.c
@@ -1054,6 +1054,7 @@ static void test_text_extents(void)
     HFONT hfont;
     SIZE sz;
     SIZE sz1, sz2;
+    BOOL ret;
 
     memset(&lf, 0, sizeof(lf));
     strcpy(lf.lfFaceName, "Arial");
@@ -1110,6 +1111,14 @@ static void test_text_extents(void)
        "GetTextExtentExPointW with lpnFit and alpDx both NULL returns incorrect results\n");
     HeapFree(GetProcessHeap(), 0, extents);
 
+    /* extents functions fail with -ve counts (the interesting case being -1) */
+    ret = GetTextExtentPointA(hdc, "o", -1, &sz);
+    ok(ret == FALSE, "got %d\n", ret);
+    ret = GetTextExtentExPointA(hdc, "o", -1, 0, NULL, NULL, &sz);
+    ok(ret == FALSE, "got %d\n", ret);
+    ret = GetTextExtentExPointW(hdc, wt, -1, 0, NULL, NULL, &sz1);
+    ok(ret == FALSE, "got %d\n", ret);
+
     hfont = SelectObject(hdc, hfont);
     DeleteObject(hfont);
     ReleaseDC(NULL, hdc);